Romania

ING Bank N.V. Amsterdam - Bucharest office

1,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2021-02-10.

Rank · Sector

#305

of 322 in Finance, Insurance and Consulting

Rank · Romania

#228

of 283

Rank · All fines

#2,601

of 3,050

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2021-02-10
Controller / Processor: ING Bank N.V. Amsterdam - Bucharest office
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 29 GDPR, Art. 32 (2), (4) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA (ANSPDCP) imposed a fine of EUR 1,000 on ING Bank N.V. Amsterdam - Bucharest Branch. It was found that the controller had sent files to a contractual partner in order to issue insurance policies. The sent files contained outdated information, as employees of the insurance policy monitoring department had not checked and processed the insurance policies according to the work process, which affected 270 people. Considering these aspects, it was found that the technical and organizational measures taken by the controller were insufficient, which resulted in the breach of confidentiality of personal data.

Open original source Links to the regulator's original publication or another source.